InstallationTokenSource (github-app/installation-tokens.ts)

* Installation-token cache — the App mode's `GitHubForgeTokenSource` (forge-contract.md §4: "It caches a token until `expiresAt` minus a safety margin, then re-mints"). One `mint()` call: return the cached token while `now < expiresAt - EXPIRY_MARGIN_MS`, otherwise sign a fresh A

// Source: https://github.com/jayminwest/warren | License: MIT | Copyright 2026 Jaymin West
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Installation-token cache — the App mode's `GitHubForgeTokenSource`
 * (forge-contract.md §4: "It caches a token until `expiresAt` minus a
 * safety margin, then re-mints").
 *
 * One `mint()` call: return the cached token while
 * `now < expiresAt - EXPIRY_MARGIN_MS`, otherwise sign a fresh App JWT
 * (./jwt.ts) and trade it at
 * `POST /app/installations/:id/access_tokens`. The margin is what keeps a
 * long run from handing out a token that dies mid-operation: installation
 * tokens expire one hour after minting (§4), so any mint inside the last
 * five minutes of a token's life re-mints instead.
 *
 * No length assumption on 

... (truncated -- full source via MCP)